IDENTITYGUARD ACTIVE DIRECTORY COLLECTOR V0.1
================================================

Purpose
-------
Creates an IdentityGuard-compatible JSON assessment file from an authorized
on-premises Active Directory environment.

The collector is read-only. It does not make any directory changes.

Collected
---------
- Enabled / disabled user accounts
- Last logon age
- Password age
- Password-never-expires
- Password-not-required
- Kerberos pre-authentication disabled flag
- Common privileged-group membership, including nested membership
- Service-account indicators (SPN + naming heuristic)
- Unconstrained delegation flag
- Computer account state, last logon, OS, password age
- Default domain password / lockout policy
- Basic domain / forest metadata

Not collected
-------------
- Passwords
- Password hashes
- Kerberos keys
- Authentication secrets
- Event log content
- Files or documents
- Email or Teams content

Requirements
------------
- ActiveDirectory PowerShell module (RSAT)
- Permission to read the Active Directory objects being assessed

Run
---
  .\IdentityGuard-AD-Collector.ps1

Anonymized output:
  .\IdentityGuard-AD-Collector.ps1 -Anonymize

Custom output path:
  .\IdentityGuard-AD-Collector.ps1 -OutputPath "C:\Temp\IdentityGuard-AD.json"

Then import the generated JSON into:
  https://labs.snehashispriyabarua.com/identityguard/

Important
---------
Use only in environments where you are authorized to perform an assessment.
Review generated JSON before sharing it outside the organization.
